---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: >= 4.0.0-beta.471, < 4.0.0-beta.474
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is susceptible to OS command injection, allowing authenticated attackers to execute arbitrary system commands via improper neutralization of special elements.

Executive Summary:
A high-severity OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system-level commands, posing a critical risk to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-42204

Affected Software: CoolLabs Coolify

Affected Versions: >= 4.0.0-beta.471, < 4.0.0-beta.474

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw. It requires an authenticated user to provide malicious input that is not properly sanitized, enabling the execution of unauthorized commands on the underlying host operating system.

Business Impact

The exploitation of this flaw allows an attacker to gain full control over the server hosting Coolify. Given the CVSS score of 8.8, this represents a high risk of total system compromise, including unauthorized data access, modification of application databases, and potential lateral movement into the broader network infrastructure.

Remediation Plan

Immediate Action: Update the Coolify instance to version 4.0.0-beta.474 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor system logs for unusual process execution, unexpected shell commands, or unauthorized modifications to critical configuration files.

Compensating Controls: Implement strict network segmentation and ensure the Coolify service runs with the least-privileged user account necessary to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The ability to execute arbitrary OS commands is a critical security failure. Administrators must prioritize upgrading to version 4.0.0-beta.474 without delay. Failure to patch this vulnerability leaves the underlying server environment exposed to full administrative takeover.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.474
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify contains a path traversal vulnerability that allows authenticated users to access or manipulate restricted files on the server.

Executive Summary:
A path traversal vulnerability in Coolify allows authenticated users to access sensitive files outside of the intended directory, threatening system confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-42200

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.474

Vulnerability: This is a Path Traversal (CWE-22) vulnerability that arises from the improper restriction of file paths. Authenticated attackers can supply specially crafted inputs to access directories or files that should be protected, leading to unauthorized read or write access.

Business Impact

The CVSS score of 8.8 indicates a high severity level. Successful exploitation could allow an attacker to read sensitive configuration files, credentials, or system files, leading to privilege escalation or complete system takeover.

Remediation Plan

Immediate Action: Update Coolify to version 4.0.0-beta.474 or newer to incorporate the necessary file path validation fixes.

Proactive Monitoring: Monitor filesystem access logs for attempts to access directories outside of the designated web root or expected application paths.

Compensating Controls: Use file system permissions to restrict the Coolify service account to the absolute minimum set of directories required for its operation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Path traversal vulnerabilities are frequently chained to achieve more severe impact. Administrators are strongly advised to apply the update to version 4.0.0-beta.474 as soon as possible to prevent unauthorized access to the host file system.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.474
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is vulnerable to an OS command injection flaw, allowing authenticated attackers to execute arbitrary code on the host operating system.

Executive Summary:
A critical OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, resulting in a high risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-42153

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.474

Vulnerability: The application incorrectly handles special characters, which allows an authenticated attacker to inject and execute OS commands. This vulnerability leverages the application's internal functions to interact with the host system unexpectedly.

Business Impact

The CVSS score of 8.8 underscores the severity of this vulnerability, which allows attackers to gain unauthorized control over the server environment. This could result in the compromise of sensitive credentials, data theft, or the use of the server in further malicious activities.

Remediation Plan

Immediate Action: Upgrade to Coolify version 4.0.0-beta.474 or higher to resolve the underlying input validation issues.

Proactive Monitoring: Review application logs for input patterns containing shell metacharacters and monitor for suspicious unauthorized system processes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common OS command injection patterns in HTTP requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Maintaining an outdated version of Coolify exposes the host environment to significant risk. It is imperative that administrators apply the provided security patch immediately to ensure the security of the application and the host server.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is susceptible to an OS Command Injection vulnerability, permitting authenticated users to execute arbitrary commands on the host server.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, potentially leading to full server compromise.

Vulnerability Details

CVE-ID: CVE-2026-42143

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This is an OS Command Injection (CWE-78) vulnerability occurring when the application fails to properly sanitize user-supplied input before passing it to system-level commands. This requires the attacker to have an authenticated session to the Coolify interface.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a high-risk scenario for any organization utilizing Coolify for infrastructure management. Exploitation could result in a full compromise of the application server, enabling the attacker to manipulate managed databases or deploy malicious applications.

Remediation Plan

Immediate Action: Update the Coolify installation to version 4.0.0-beta.471 or higher to patch the command injection vulnerability.

Proactive Monitoring: Monitor system audit logs for unauthorized command execution or unexpected spikes in CPU usage associated with the Coolify service.

Compensating Controls: Implement strict network segmentation to ensure the host system is not directly accessible from untrusted networks, reducing the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate patching is required to secure the environment. Organizations should verify that their instance of Coolify is updated to at least version 4.0.0-beta.471 to ensure this vulnerability is addressed.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify contains an OS command injection vulnerability that allows authenticated users to execute arbitrary system commands via improper input neutralization.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, potentially leading to a full host compromise.

Vulnerability Details

CVE-ID: CVE-2026-34599

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability is caused by improper neutralization of special elements within OS commands. It allows a low-privilege authenticated attacker to escape intended command boundaries and execute arbitrary code on the host system.

Business Impact

With a CVSS score of 8.8, this flaw presents a substantial risk to the security of the infrastructure. Unauthorized command execution can lead to data exfiltration, service disruption, and complete loss of control over the self-hosted environment.

Remediation Plan

Immediate Action: Update the Coolify installation to version 4.0.0-beta.471 or later as specified in the vendor's security advisory.

Proactive Monitoring: Monitor the server for unauthorized shell access or unusual child processes spawned by the Coolify service.

Compensating Controls: Implement strict firewall rules to restrict network access to the Coolify administrative interface to trusted users only, reducing the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS severity, immediate patching is required. Administrators should verify their current version and apply the recommended update to mitigate the risk of remote command execution.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is vulnerable to a Cross-Site Request Forgery (CSRF) attack, which could allow an unauthorized party to perform actions on behalf of an authenticated user.

Executive Summary:
A Cross-Site Request Forgery (CSRF) vulnerability in Coolify could enable attackers to perform unauthorized actions, potentially leading to a full compromise of the application environment.

Vulnerability Details

CVE-ID: CVE-2026-34171

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability is a CSRF (CWE-352) flaw where an attacker can trick an authenticated user into executing unwanted actions within the Coolify interface. This is typically achieved by enticing a user to click a malicious link while they have an active session.

Business Impact

With a CVSS score of 8.0, this vulnerability poses a significant risk to the confidentiality and integrity of the application. An attacker could force administrative actions, such as changing system settings or creating new user accounts, leading to unauthorized access and potential data exfiltration.

Remediation Plan

Immediate Action: Upgrade to Coolify version 4.0.0-beta.471 or later to implement the required CSRF protection mechanisms.

Proactive Monitoring: Review audit logs for unexpected account modifications or changes to application settings that do not align with known administrative activity.

Compensating Controls: Encourage users to log out of the Coolify dashboard when not in use and implement browser-based security policies to mitigate CSRF risks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

CSRF vulnerabilities can be highly damaging in management tools like Coolify. It is essential to update to the patched version immediately to ensure that session integrity is maintained and to prevent unauthorized administrative actions.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is vulnerable to OS Command Injection, allowing authenticated users to execute arbitrary commands on the underlying host system.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to achieve remote code execution, posing a severe risk to host infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-34168

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw that allows an authenticated user with low privileges to inject and execute arbitrary OS commands. The vulnerability exists due to improper neutralization of special elements used in system calls.

Business Impact

Successful exploitation allows an attacker to gain unauthorized control over the server hosting Coolify. Given the high CVSS score of 8.8, this vulnerability could lead to complete system compromise, unauthorized data access, and the potential for lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.471 or later immediately to resolve the injection flaw.

Proactive Monitoring: Review system logs for suspicious process execution patterns or unexpected shell commands originating from the Coolify service account.

Compensating Controls: Ensure the Coolify service is running with the least privilege necessary on the host OS to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity and confidentiality of the host environment. Administrators should prioritize patching to version 4.0.0-beta.471 immediately to mitigate the risk of remote code execution.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.469
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is vulnerable to OS Command Injection, allowing an authenticated user to execute arbitrary commands on the underlying host system.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, posing a high risk to server integrity and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-34158

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.469

Vulnerability: This vulnerability is an OS Command Injection (CWE-78) flaw that permits an authenticated user with low-level privileges to inject malicious commands into the host operating system. The vulnerability stems from improper neutralization of special elements used in system calls.

Business Impact

The ability to execute arbitrary OS commands provides an attacker with a foothold on the server, potentially leading to full system compromise. With a CVSS score of 8.8, this high-severity vulnerability could result in unauthorized data exfiltration, service disruption, and the deployment of persistent malware within the infrastructure.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.469 or later to incorporate the necessary security patches.

Proactive Monitoring: Review system and application logs for unexpected shell process executions or irregular administrative activity.

Compensating Controls: Implement strict network segmentation and restrict access to the management interface to trusted IP addresses to limit the potential attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score of 8.8, this vulnerability represents a significant risk to the security of the host environment. Organizations should prioritize updating their Coolify instances to the latest available version immediately to remediate the command injection vector and prevent potential unauthorized remote code execution.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is susceptible to an OS Command Injection vulnerability, allowing authenticated attackers to execute arbitrary system commands on the host server.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary code on the underlying host, posing a significant risk to the entire self-hosted environment.

Vulnerability Details

CVE-ID: CVE-2026-34153

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: The application fails to properly neutralize special elements used in an OS command, enabling an authenticated user to perform OS command injection. This vulnerability requires a low-privilege authenticated session to initiate the attack.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute commands with the privileges of the Coolify application. Given the CVSS score of 8.8, this poses a high risk of full system compromise, unauthorized data access, and potential lateral movement into other databases or services managed by the platform.

Remediation Plan

Immediate Action: Upgrade Coolify to version 4.0.0-beta.471 or later to implement the necessary input neutralization patches.

Proactive Monitoring: Review system and application access logs for unusual command executions or unexpected process spawning originating from the Coolify service account.

Compensating Controls: Ensure the Coolify instance is running in an isolated container with minimal host-level permissions to limit the impact of a potential container escape or code execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security risk to the integrity of the host server. Administrators are urged to prioritize the update to the latest version immediately to eliminate the command injection vector.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is vulnerable to OS Command Injection, enabling authenticated attackers to execute arbitrary system commands through insecure input handling.

Executive Summary:
An authenticated OS Command Injection vulnerability in Coolify allows for remote code execution, threatening the integrity of the host environment.

Vulnerability Details

CVE-ID: CVE-2026-34152

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability (CWE-78) occurs due to the improper neutralization of special characters in input fields, allowing an authenticated attacker to inject and execute OS-level commands. This effectively bypasses the application's intended functional boundaries.

Business Impact

The ability to execute OS commands on the host server provides an attacker with broad capabilities, including data theft, privilege escalation, and persistent backdooring of the environment. The CVSS score of 8.8 highlights the high risk associated with this vulnerability, requiring prompt remediation to prevent unauthorized access to critical infrastructure.

Remediation Plan

Immediate Action: Apply the vendor-provided update to version 4.0.0-beta.471 or later to remediate the command injection flaw.

Proactive Monitoring: Regularly audit server access logs and monitor for unexpected command execution or child processes being spawned by the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common shell injection patterns in request parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security risk for Coolify users. Administrators are strongly advised to perform the update to version 4.0.0-beta.471 across all environments to ensure protection against potential exploitation.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify contains an OS Command Injection vulnerability allowing authenticated attackers to execute arbitrary commands on the host system via improper input neutralization.

Executive Summary:
An authenticated OS Command Injection vulnerability in Coolify permits remote code execution, posing a critical risk to host server security.

Vulnerability Details

CVE-ID: CVE-2026-34058

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This flaw is classified as CWE-78, where the application fails to properly sanitize user-supplied input before passing it to a system shell. Authenticated users can leverage this weakness to execute arbitrary OS commands, bypassing intended application restrictions.

Business Impact

An attacker exploiting this vulnerability could gain unauthorized control over the server, potentially leading to the compromise of hosted databases and application data. With a CVSS score of 8.8, the potential for full system takeover makes this an urgent security concern for organizations relying on Coolify for infrastructure management.

Remediation Plan

Immediate Action: Update the Coolify installation to version 4.0.0-beta.471 or higher to patch the command injection vulnerability.

Proactive Monitoring: Monitor system logs for unusual shell activity or unauthorized process spawning associated with the Coolify service.

Compensating Controls: Implement strict network segmentation and egress filtering to prevent the application from making unauthorized outbound connections if the server is compromised.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS severity, failure to remediate this vulnerability exposes the entire server environment to potential takeover. Organizations must treat this as a high-priority update and apply the patch to all affected instances immediately.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.471
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is susceptible to an OS Command Injection vulnerability that allows authenticated attackers to execute arbitrary system commands on the host server.

Executive Summary:
A critical OS Command Injection vulnerability in Coolify allows authenticated attackers to achieve remote code execution on the underlying host system.

Vulnerability Details

CVE-ID: CVE-2026-34057

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.471

Vulnerability: This vulnerability involves improper neutralization of special elements used in an OS command (CWE-78). An attacker with low-level authenticated access can manipulate input parameters to execute arbitrary commands with the privileges of the Coolify application.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the host environment. An attacker achieving remote code execution could gain full control over the server, leading to data exfiltration, lateral movement within the network, or total system compromise. Given the CVSS score of 8.8, this represents a high-severity threat that requires immediate attention.

Remediation Plan

Immediate Action: Upgrade to Coolify version 4.0.0-beta.471 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review application and system audit logs for suspicious process execution patterns or unexpected command-line arguments originating from the Coolify service account.

Compensating Controls: Ensure the Coolify application runs with the principle of least privilege, utilizing containerization or restricted service accounts to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The presence of an OS command injection vulnerability in a self-hosted management tool is highly dangerous. Administrators should prioritize upgrading their Coolify instances to version 4.0.0-beta.471 immediately to mitigate the risk of unauthorized system-level access.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.466
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is affected by an authorization bypass vulnerability, allowing authenticated users to access resources they are not permitted to view via user-controlled keys.

Executive Summary:
An authorization bypass vulnerability in Coolify allows authenticated users to access sensitive data outside their scope, posing a significant risk to internal data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-34044

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.466

Vulnerability: This flaw involves an Authorization Bypass Through User-Controlled Key (CWE-639). An authenticated user can manipulate identifiers to access resources or data belonging to other users or system areas they are not authorized to interact with.

Business Impact

The CVSS score of 7.7 reflects a high risk of unauthorized information disclosure. By bypassing authorization controls, an attacker can access sensitive environment configurations, database credentials, or other critical data, leading to severe reputational and security consequences for the organization.

Remediation Plan

Immediate Action: Upgrade to Coolify version 4.0.0-beta.466 or later to enforce proper authorization checks.

Proactive Monitoring: Analyze application access logs for patterns of unusual resource requests, particularly those involving sequential IDs or out-of-bounds object access.

Compensating Controls: Use a Web Application Firewall (WAF) to filter and inspect requests for suspicious parameter manipulation if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authorization bypass flaws undermine the fundamental security model of any multi-user application. Administrators must apply the vendor-provided security update to version 4.0.0-beta.466 to ensure that resource access control policies are correctly enforced and data privacy is restored.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.466
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify is susceptible to an OS command injection vulnerability, enabling authenticated users to perform unauthorized command execution on the host machine.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, posing a substantial risk to the confidentiality and integrity of the system.

Vulnerability Details

CVE-ID: CVE-2026-34035

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.466

Vulnerability: This vulnerability is classified as an OS Command Injection (CWE-78) occurring when the application fails to properly validate user-supplied input before passing it to system-level commands. Authenticated users can exploit this to achieve unauthorized code execution.

Business Impact

With a CVSS score of 8.8, the vulnerability presents a high risk of total system compromise. Successful exploitation could result in the breach of sensitive data, disruption of critical business services, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade to Coolify version 4.0.0-beta.466 or newer immediately.

Proactive Monitoring: Review logs for unusual system calls and monitor for unauthorized changes to system configurations or files.

Compensating Controls: Restrict administrative access to the Coolify dashboard using multi-factor authentication and IP allowlisting to mitigate the risk of unauthorized exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of command injection flaws, immediate patching is necessary to secure the environment. Ensure that all affected Coolify instances are updated to the specified version to neutralize this high-severity threat.

---METADATA---
VENDOR: CoolLabs
PRODUCT: Coolify
AFFECTED_VERSIONS: < 4.0.0-beta.466
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Coolify contains an OS command injection vulnerability that allows an authenticated user to execute arbitrary commands on the host server.

Executive Summary:
An OS command injection vulnerability in Coolify allows authenticated attackers to execute arbitrary system commands, leading to potential full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-34034

Affected Software: CoolLabs Coolify

Affected Versions: < 4.0.0-beta.466

Vulnerability: This is an OS Command Injection vulnerability (CWE-78) triggered by the improper sanitization of inputs processed by the application. An authenticated user can leverage this flaw to run unauthorized commands on the underlying operating system.

Business Impact

A CVSS score of 8.8 underscores the severity of this issue, as it allows attackers to bypass security controls and gain unauthorized access to the host server. This could lead to severe consequences, including data theft, manipulation of hosted databases, or the total loss of server availability.

Remediation Plan

Immediate Action: Update Coolify to version 4.0.0-beta.466 or later to apply the security fix.

Proactive Monitoring: Continuously audit access logs for suspicious command patterns and monitor server performance for unauthorized background processes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common shell injection signatures.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk posed by this OS command injection is severe and requires prompt attention. Security teams must ensure all Coolify deployments are patched to the fixed version to prevent authenticated actors from escalating their privileges to the OS level.